CVE-2026-53193
Received Received - Intake
Linux Kernel Timer Use-After-Free Vulnerability

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tries to unlink all instances and just set NULL to each ti->timer, then releases the resources immediately. The problem is, however, when there are slave timer instances that are associated with a master instance linked to this timer: namely, those slave instances still point to the freed timer object although the master instance is unlinked, which may lead to user-after-free. The bug can be easily triggered particularly when a new userspace-driven timers (CONFIG_SND_UTIMER) is involved, since it can create and delete the timer object via a simple file open/close, while the other applications may keep accessing to that timer. This patch is an attempt to paper over the problem above: now instead of just unlinking, call snd_timer_close[_locked]() forcibly for each pending timer instance, so that all assigned slave timer instances are properly detached, too. Since snd_timer_close() might be called later by the driver that created that instance, the check of SNDRV_TIMER_IFLG_DEAD is added at the beginning, too.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53193
EUVD
EUVD-2026-39284
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

The vulnerability is resolved by a patch in the Linux kernel that forcibly closes timer instances when they are freed, preventing user-after-free conditions related to ALSA timer objects.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this patch.

Executive Summary

This vulnerability exists in the Linux kernel's ALSA timer subsystem. When a snd_timer object is freed while there are still pending snd_timer_instance objects linked to it, the system attempts to unlink these instances and set their timer pointers to NULL. However, if there are slave timer instances associated with a master instance linked to this timer, those slave instances may still point to the freed timer object, leading to a user-after-free condition.

This bug can be triggered especially when userspace-driven timers (CONFIG_SND_UTIMER) are involved, as these timers can be created and deleted simply by opening and closing files, while other applications might continue accessing the timer.

The fix involves forcibly closing each pending timer instance to ensure all slave timer instances are properly detached, preventing them from referencing freed memory.

Impact Analysis

This vulnerability can lead to a user-after-free condition in the Linux kernel's ALSA timer subsystem. Such a condition may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the use of freed memory.

Since the issue involves timers that can be manipulated from userspace, it may be triggered by applications interacting with the sound system, potentially impacting system reliability and security.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart